Privacy Policy
Last updated September 4, 2026
What we collect, why we collect it, who sees it and how to get it removed. We do not sell your personal information.
1. Scope
This policy explains what pep&bones collects when you visit this site or order from us, why we collect it, who we share it with and what control you have. It covers pepandbones.com and our order and email systems.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the past twelve months.
2. What We Collect
| Category | Examples | Why |
|---|---|---|
| Contact | Name, email, phone, shipping address | To take payment, ship your order and send receipts and delivery notices |
| Order | Items, plan type, order history, delivery schedule | To fulfil orders and run subscriptions |
| Payment | Handled by our payment processor. We receive a token, the card brand and last four digits | To take payment and process refunds. Full card numbers never reach our servers |
| About your dog | Weight, age, mobility rating | To calculate the scoop count and set your delivery interval |
| Technical | IP address, browser and device type, pages viewed, referring site | To keep the site working, diagnose faults and understand aggregate traffic |
| Correspondence | Emails and support messages | To answer you and keep a record |
We do not knowingly collect information from anyone under 18. If you believe a child has given us information, email us and we will delete it.
3. How We Use It
- To process, ship and support your orders and subscriptions.
- To calculate dosing and delivery timing from the details you enter.
- To send transactional messages: receipts, shipping notices, renewal reminders and changes to these policies.
- To send marketing email, only if you opted in. Every marketing email has an unsubscribe link, and unsubscribing does not stop transactional messages.
- To detect and prevent fraud and abuse, and to meet legal and tax obligations.
4. Who We Share It With
We share only what a provider needs to do its job, and only with providers bound to protect it:
- Payment processing. To charge your card and issue refunds.
- Shipping carriers and fulfilment. To pick, pack and deliver, which requires your name and address.
- Email delivery. To send receipts and notices.
- Hosting and analytics. To serve the site and measure aggregate traffic.
- Professional advisers and authorities. Where we are legally required, or to establish or defend legal claims.
- A successor if the business is sold or merged. You will be told if that happens.
5. Cookies
We use cookies and similar storage to keep the site working, remember what is in your cart and your place in checkout, and measure aggregate usage. Your browser can block or delete cookies, though parts of checkout may stop working if you block them. We honour Global Privacy Control signals where required.
6. How Long We Keep It
Order and transaction records are kept as long as tax and accounting law requires, generally seven years. Marketing contact details are kept until you unsubscribe or ask us to delete them. Support correspondence is kept for up to three years. Technical logs are kept for a short period, generally under twelve months.
7. Security
The site is served over TLS, payment details are tokenised by our processor and never stored by us, and access to order data is limited to people who need it. No system is perfectly secure, so we cannot guarantee absolute security.
8. Your Rights
Depending on where you live, you may have the right to:
- Know what personal information we hold and get a copy of it.
- Correct information that is wrong.
- Delete information, subject to records we must keep by law.
- Opt out of marketing at any time.
- Not be discriminated against for exercising these rights.
California residents have these rights under the CCPA as amended by the CPRA, including the right to know, delete, correct, and to opt out of sale or sharing. As stated above, we do not sell or share personal information. Residents of the EEA and UK may also have rights to restrict or object to processing and to data portability; where the GDPR applies, our bases for processing are performance of a contract, our legitimate interests in running and securing the business, your consent for marketing, and compliance with legal obligations.
To exercise any right, email hello@pepandbones.com from the address on your order, or write to us at the postal address below. We will verify your request and reply within the time the applicable law allows, generally 45 days in California. You may use an authorised agent.
9. International Transfers
We operate from the United States and our providers may process data there. If you order from outside the United States, you understand your information will be transferred to and processed in the United States, where privacy law may differ from your own.
10. Changes
If we change this policy the date at the top will change, and we will email active customers about material changes.
11. Contact
pep&bones, 30 N Gould St, STE R, Sheridan, Wyoming 82081
hello@pepandbones.com